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A novel safehold control law was developed for the nadir-pointing Vegetation Canopy 
Lidar (VCL) spacecraft, necessitated by a challenging combination of constraints. The 
instrument optics did not have a recloseable cover to protect them from potentially catas- 
trophic damage if they were exposed to direct sunlight. The baseline safehold control law 
relied on a single-string inertial reference unit. A gyroless safehold law was developed to 
give a degree of robustness to gyro failures. Typical safehold solutions were not viable; 
thermal constraints made spin stabilization unsuitable, and an inertial hold based solely on 
magnetometer measurements wandered unacceptably during eclipse. The novel approach 
presented here maintains a momentum bias vector not for gyroscopic stiffness, but to use 
as an inertial reference direction during eclipse. The control law design is presented. The 
effect on stability of the rank-deficiency of magnetometer-based rate derivation is assessed. 
The control law’s performance is evaluated by simulation. 


I. Introduction 

T he Vegetation Canopy Lidar (VCL) was planned as an altimetry mission to create maps of the three- 
dimensional structure of vegetation in the world’s forests. The primary science objective was to produce 
a global estimate of how much carbon the forests hold. In Science Mode the VCL spacecraft is a three-axis 
stabilized Earth pointer with two two-axis sun tracking solar arrays, as shown in Figure 1. The VCL mission 
presented some unique challenges to the attitude control design. The Multi-Beam Laser Altimeter (MBLA) 
instrument optics were sensitive, and would be catastrophically damaged if sunlight fell into the instrument 
within 16 deg of its boresight axis. For thermal design reasons, the instrument had no cover, so keeping 
sunlight out of the instrument became an attitude control problem. In Science Mode, the instrument is 
Earth-pointed, which addresses the safety of the optics in a natural fashion, but instrument protection must 
also be assured in case of an attitude anomaly. 

A Safe Mode is required to protect against a loss of data from either the single-string star tracker or the 
single-string gyro. There is a challenge, however, in conceiving and implementing a suitable Safe Mode. An 
Earth-pointing Safe Mode would seem a logical option, but thermal and power issues preclude it. Power 
and thermal design dictate that, while in sunlight, a two-axis-inertial Sun-pointing attitude be maintained 
that provides heat input to the MBLA instrument radiators as well as energy to the solar arrays. In control 
terms, the Sun vector must be controlled to a commanded direction in the spacecraft body frame. No 
particular orientation “around” the Sun line is preferred; rate damping about that axis is sufficient. While in 
the eclipsed portion of the orbit, there are no requirements on attitude, except that the instrument must not 
point too close to the Sun on re-entry into sunlight, or in re-acquiring the daylight Sun-pointing attitude. 

With the proper sensor-actuator suite, maintaining a Sun-pointing inertial attitude presents no special 
problems; sun sensors, a gyro, and three-axis wheel control would be straightforward enough. To assure 
Safe Mode reliability in the event of a component failure, redundancy should be employed, and dependence 
on non-mission-critical, single-string components should be avoided. Multiple coarse sun sensors provide 
redundancy and sufficient accuracy. Reaction wheels are four-for-three redundant. But mass, power, and 
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Figure 1. The VCL Spacecraft 


early design philosophy led to selection of a single-string gyro; a non-mission-critical component. A gyro- 
based Safe Mode was considered but the Fiber Optic Gyro’s susceptibility to radiation, which could cause 
it to reset, is a problem for Safe Mode. Should a gyro reset occur when the satellite is in Safe Mode and in 
eclipse, the attitude reference is lost. Should a computer reset occur in eclipse, the satellite will go to Safe 
Mode with no reference attitude. Thus, a Safe Mode which does not rely on a gyro is to be preferred. 

A gyroless Safe Mode is still relatively straightforward in sunlight. The sun sensors provide attitude 
signals, and rate signals may be derived from sun sensor signals and from magnetic field measurements. 
(Note that the magnetometer, while not redundant, is a high-reliability component.) In eclipse, however, the 
Sun vector measurement is unavailable, and rate propagation without a gyro yields unacceptable attitude 
drift. Several alternative Safe Mode architectures were considered and discarded; of note are using the 
geomagnetic field vector as a pointing reference, and using a traditional momentum-bias safe mode. The 
magnetic field vector is not a suitable reference, as it may take any orientation with respect to the Sun vector 
in the VCL orbit (400 km altitude, 65 deg inclination). Momentum-bias safe modes, using precession and 
nutation control, do not satisfy power and thermal requirements, and do not keep the instrument safe for 
some typical initial conditions. Some other approach is required. A momentum bias vector stored in the 
reaction wheels was considered as an attitude reference during eclipse. 

Goddard Space Flight Center had previously studied the use of a momentum bias to provide a gyroless 
attitude reference for the wheel control system on the International Ultraviolet Explorer (IUE). • The 
system proposed for IUE applied a momentum bias perpendicular to the sunline and measured the transfer 
of this momentum between the spacecraft reaction wheels to control roll about the sunline. The three-axis 
stabilized system used continuously available information from the fine sun sensor to control the two sun- 
pointing axes. After more than eighteen and a half years, at the end of the IUE spacecraft life on September 
30, 1996, one gyro remained operational. The proposed zero-gyro system was never used. 

The VCL Gyroless Safe Mode design controls the spacecraft to assume different orientations depending 
on whether it is in sunlight or eclipse. When in daylight, the satellite is oriented to maintain the Sun at an 
angle of 70 deg from the +Z axis, as shown in Figure 2. This permits partial illumination of the backside 
instrument radiators to maintain thermal control, while shielding the MBLA optics from damage. The solar 
arrays are parked in the position shown. During the sunlit portion of the orbit, the Sun-pointing safe attitude 
is maintained using three-axis wheel control. At the same time, the magnetic torquers are used to control 
the system angular momentum to a desired magnitude and direction; 3 Nms along the spacecraft -Y axis, 
which is maintained at 20 deg from the Sun direction. The angular momentum is stored in the reaction 
wheels and body rates are nulled. This daylight control law is not described further in this paper. 

Neglecting external torques, the angular momentum of the spacecraft-and- wheel system is conserved; it is 
a vector quantity, fixed in inertial space. Through eclipse, it will maintain the inertial orientation established 
during daylight, with some drift due to environmental torques. Its components in the spacecraft body frame 
can be measured, so it can be used as an attitude reference. A control law can be formulated to point the 
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Figure 2. Safe Mode attitude Viewed from the Sun 


instrument boresight axis opposite to the angular momentum vector, and thus away from the Sun. This is 
the concept implemented on VCL and described in this paper. 

Upon entry into eclipse, the +Z axis is reoriented to be anti-parallel to the momentum reference vector, 
and thus nearly opposite to the Sun vector. When the spacecraft exits from eclipse, the +Z axis is returned 
to its daylight orientation. Over the course of the eclipse, the momentum reference vector drifts due to envi- 
ronmental torques; the momentum magnitude is chosen so that this drift is acceptably small, in combination 
with the anti-Sun nominal pointing direction, to assure instrument safety. For VCL, a momentum bias of 
3 Nms is sufficient to limit the drift to less than 0.1 radian. In eclipse, a state feedback control law is used 
to point the instrument relative to the measured momentum vector, directly opposite the momentum. The 
feedback states are angular rate as derived from magnetic field measurements, and wheel momenta. 

This eclipse control law is the topic of this paper. In section II, we derive the system equations of motion 
and derive a rate measurement from magnetic field measurements. Robust state feedback gains are found in 
section III. We examine the effect of the rank-deficiency of magnetic rate estimation on stability in section 
IV, and present the effect of magnetic field orientation on the system’s closed-loop roots in section V. Time- 
domain simulation results are discussed in section VI, and some concluding remarks are offered in section 
VII concerning the applicability of this type of Safe Mode to other missions. 

II. Equations of Motion 

The differential equations of motion are derived from the conservation of angular momentum, neglecting 
torques external to the spacecraft-reaction wheel system: 

j t (Jw + H)= 0 

where J is the spacecraft rigid-body inertia matrix, oj is the spacecraft angular velocity vector, and H is the 
angular momentum of the reaction wheel system, expressed in the spacecraft body frame. Expanding, we 
obtain 

Jlo + H + lo x (Jw + H) = 0 (1) 

where the overdot operator ( ) denotes differentiation with respect to time, in the frame of the spacecraft 
body. 

II. A. Feedback Law 

The control torque, u, is exerted on the spacecraft body by the reaction wheel system. We choose a state 
feedback control law for eclipse based on the states lo and H. 

u = -K u u - K h H (2) 
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where Q is the measured angular rate, and K u and I\h are gain matrices. The control torque is exerted on 
the spacecraft body by the reaction wheels: 


u = — H 


(3) 


II. B. Rate Measurement 


While the wheel tachometers provide a complete and accurate measurement of H, the measurement of u 
presents a problem. Some sort of rate feedback is required for a stabilizing closed-loop controller. Since 
the point of a gyroless safe mode is to avoid dependence on a possibly failed gyro, some other rate sensing 
mechanism is required. We will use the magnetometer to deduce the body angular rates. 

The rates of change of a vector, as measured in two reference frames rotating relative to each other, 
are related through the relative angular velocity of the two frames. We use this fundamental relationship 
to deduce the angular velocity of the body frame (B) in an inertial reference frame (N) by measuring the 
magnetic field vector. This is the foundation for the classical “B-dot” rate-damping law. 


JV 


dB 


3 dB 


- N to B x B 


dt dt 

As the spacecraft orbits the Earth in a near-polar orbit, it passes through the geomagnetic field so that the 
inertial direction of the geomagnetic field is seen to rotate at an average of twice orbit rate. For the purposes 
of this controller, this is an acceptably small residual error rate, so we do the usual thing and neglect it: 

B dB 


0 = 


dt 


- N to B x B 


Noting that all quantities are expressed in the body frame, we simplify our notation: 

0 = B + to x B 


(4) 


Angular rate derivation is insensitive to variation in the magnitude of the magnetic field vector; rotating the 
body cannot change the strength of the magnetic field. The succeeding analysis is simplified if the magnetic 
field vector is normalized to unity magnitude: 


\B\ = y/B* + B* + B* = l 

This normalization is assumed throughout the following analysis. 

Equation (4) cannot in general be solved exactly for u>. The least-squares projection is 

u> = B x B 

The component of w which is parallel to B makes no contribution to B, and so is unobservable: 

u) = ui — (u> ■ B) B 

which may be rewritten 



1 -B\ 

~BiB 2 

—B 1 B 3 

id = 

—B 2 Bi 

1 -B\ 

— -B2-B3 


—B 3 Bi 

~B^B 2 

1 - Bl _ 

Kb 


(5) 


The matrix Kb is singular (of rank 2), and thus has no true inverse. Its pseudo-inverse has the interesting 
property of being Kb itself: 

K+ = K b (6) 

This is a property of projection matrices; it may be verified by applying Penrose’s four conditions for the 
pseudoinverse: 


AA+A = A 

(7) 

A + AA + = A + 

(8) 

(aa+) t = aa+ 

(9) 

(A+A) T = A+ A 

(10) 
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II. C. Linearization 

Eliminating H from (1) and substituting K b uj for d>, we obtain 


J LO T hx u K T R-h-H UJ X [Juj T -ft) — 0 


( 11 ) 


Combining (2) and (3) to isolate H, 


II = KcjKblo + K h H 


(12) 


These are our six differential equations of motion, the six dynamic variables being the three components of uj 
and the three components of H. The desired equilibrium state is u; = [ 0 0 0 ], H = [ 0 0 A], where 

A = — 3 Nms. This target state causes the body Z axis, which is the instrument boresight axis, to point 
directly opposite the angular momentum vector. 

Considering small perturbations from this state, we may write the uj x H term as 



0 X + h 3 

-h 2 



uj x H = 
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(13) 


where [hi, h 2 , h 3 ] are small perturbations from the target momentum. Neglecting products of small variables, 


uj x Juj ~ 0 
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which allows us to write the linearized equations of motion in the form 
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or, re-introducing the control torque vector u, 
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(14) 

(15) 


(16) 


(17) 

(18) 


The variability of K B complicates the formulation of a linear feedback control design. We proceed by 
defining a constant rate gain matrix K r for use in gain selection and linear stability analysis: 


K r = KJ< b 


(19) 


so that 


u = — 


Kr I< h 



(20) 


This allows the linear analysis to proceed as if we had constant gains and full access to the angular rate states, 
uj. In the on-orbit implementation, however, the control law will have to use the available rate measurement 
uj rather than uj itself, so, 


u = — 


K u K h 


UJ 

H 


(21) 


Since K r is constant by design, and K B varies with the orientation of the geomagnetic field in the spacecraft 
body frame, K w must also vary with magnetic field orientation. Equation (19) cannot be solved exactly for 
K u , but the least-squares solution is 


K u = K r K+ = K r K B 


( 22 ) 
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since Kb is its own pseudoinverse. Given a particular Co and Kb, K U Q is, in the least-squares sense, the 
best estimate of K r to available. The final form of the implemented control law is 


u = — 


Kr K h 


Kbu > 
H 


(23) 


The derived rate, to, is premultiplied in the flight software by the (measured) magnetic projection matrix, 
Kb, before the constant rate gain, K r , is applied. 

Once the control gains have been obtained, the effect of magnetic field variation will be checked by 
examining the motion of the closed-loop system roots over all possible magnetic field orientations. 


III. Gain Selection 


The equations of motion have been derived for a three-axis system. It is appropriate at this time to 
decouple the Z axis from the X-Y subsystem. The purpose of the controller is to point the spacecraft Z axis 
to a particular inertial direction, which is accomplished by control of the X-Y dynamics. The orientation 
about the Z axis is immaterial; rate damping is all that is required about that axis. So the Z axis control 
law will use rate feedback of the sensed Z rate component, w 3 , and in this section we will consider only the 


X-Y subsystem, using the four-element state, 


to 1 to 2 hi h 2 


The linearized equations of motion for the X-Y system are 


f w 
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l«J 
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u = —K 


where the 2 x 2 inertia matrix, J, takes on values 
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(25) 


J = 


144 0 

0 167 


kg-m“ 


(26) 


and the 2 x 2 K \ is 


A a = 


0 A 

-A 0 


(27) 


that yields stable and well- 


with A = — 3 N-m-s. We seek a 2x4 feedback gain matrix K = K r Kh 
behaved system roots. 

We use the Linear Quadratic Regulator (LQR) method to obtain a state feedback gain matrix. The 
LQR is appealing in that we don’t need a priori knowledge of the structure of K to constrain the design. 
(Proponents of pole placement, among whom we number, might point out that this lack of insight can be 
a drawback as well as a feature.) Instead, we must assign relative weights to penalties on state and control 
magnitudes. In practice, these relative weights are adjusted iteratively to satisfy other design criteria like 
system bandwidth or transient response. After some iteration in conjunction with simulation to assure 
acceptable transient behavior, we arrive at the penalty weights w m ax = 0.002 r/s, h m ax = 0.3 Nms, and 
Umax = 0.007 Nm. 

The LQR formulation requires the matrices A, B, Q, and R. The A and B matrices are as identified in 
equation (24) and the penalty matrices are 


Q = 
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“max 
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(28) 
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u max 


(29) 


R = 


0 


0 %ax 

Once these input matrices are defined, the LQR gain matrix is found using the Matlab function lqr: 


2.9557 -2.0188 -0.02 -0.0121 

1.7407 2.9557 0.0121 -0.02 


(30) 


IV. Robust Stability Analysis 


Good engineering practice and our subsystem requirements dictate that we maintain at least 6 dB gain 
margin and 30 deg phase margin in our control design. We apply the robust MIMO stability analysis methods 
described in Skogestad and Postlethwaite (S&P) to determine and interpret the stability margins of this 
system. 

The plant transfer function is written in general 


G = C{sI- A)~ l B + D 


(31) 


In this case, C is an identity matrix and D = 0. Defining uj n so that 
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we find 
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(33) 


Robust stability is verified by examination of the matrix transfer function M, from the output to the 
input of the perturbations (see S&P, Figure 8.3). The maximum singular value of the transfer function 
may be used as an upper bound on the frequency response of a transfer function to a unit input. We must 



Figure 3. Singular Values of M Transfer Function 
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still, however, choose a model of the plant uncertainties. Skogestad and Postlethwaite suggest and develop 
several alternatives (see S&P, 4 Sections 8. 2-8. 6). For this analysis, we assume that uncertainties may be 
lumped as “multiplicative input uncertainties”. This compares directly to the SISO idea of uncertainty in the 
loop gain. But a MIMO analysis also requires some model of the “direction” of uncertainties in the various 
dimensions of the state space. If some inputs are better known than others, then the input uncertainties have 
some structure, knowledge of which may be used to make more precise statements about the sensitivities 
of the system. We make the conservative assumption that the input uncertainty is “unstructured”, i.e. no 
knowledge of the relative uncertainties of the various inputs is assumed. This establishes a conservative upper 
bound on the effect of uncertainties on the stability of the system. An unstructured uncertainty weighting 
matrix, W, is written 


W = k 


1 1 
1 1 


(34) 


where A; is a scalar parameter which we will use to determine the degree of robust stability. Using a 
multiplicative input uncertainty leads to (see S&P, 1 Section 8.6.1) 


M = WK (I + GK)~ 1 G 


(35) 


The system is then said to be robustly stable to some level (represented by k) with respect to unstructured 
multiplicative input uncertainty if the maximum singular value of M is less than or equal to one over all 
frequencies: 

a{M{jd))< 1 (36) 

We choose an input uncertainty k = 0.5, corresponding to our required 6 dB gain margin. The maximum 
singular value of M is plotted in figure 3 for k = 0.5. We conclude that our equivalent gain margin is at least 
6 dB, and is probably more, given the conservative assumptions made. 


V. Root Motion Due to Magnetic Field Orientation 


We have used MIMO linear design techniques to obtain a set of constant feedback gains based on body 
rate and wheel momentum state variables. As was discussed in the linearization section, however, the rate 
component parallel to the magnetic field is unobservable to the Bdot rate measurement method. At first 
glance, this may seem a fatal defect in the method; having no rate information about one axis, how may 
one stabilize that axis? We recall, however, the classic technique for Earth-pointing spacecraft which uses 
an angular momentum vector to couple the roll-yaw dynamics so that stable control is achieved with no 
yaw rate sensor. The present case is complicated by the “blind” axis not being body-fixed. So we undertake 
to demonstrate that coupling introduced by the angular momentum vector and the non-diagonal controller 
gain matrices ensures stable behavior at all times. We do this by surveying the roots of the dynamic system, 
accounting for the effect of deriving rates from magnetic field measurements. 

We recall the equations of motion in the form 


a 1 

L_[ 

l*J 



- J- 1 {K^Kb + K x ) 

K^Kb 


—J~ x Kh 

I< h 


1J 

^ i 

Jl 



(37) 


The closed-loop dynamic roots are then the eigenvalues of the coefficient matrix, A. Using the controller 
gains obtained by the nominal linear analysis, we may plot the system roots for all possible orientations of 
the magnetic field vector. To do this, we define a “latitude-longitude” grid system fixed in the spacecraft 
body frame, with the polar axis parallel to the Z axis. We then construct a magnetic field vector for each of a 
set of grid points, and compute the corresponding system roots. Figure 4 shows the results of such a survey, 
covering the entire sphere with five-degree grid spacing. The roots do move with magnetic field orientation, 
but they are always in the left-half plane except for one root, corresponding to Z axis angle, which always 
lies at s = 0. This is expected, as the Z axis angle is neither sensed nor controlled. 
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Figure 4. Root Motion due to Magnetic Field Orientation 


VI. Simulation Results 

Flight software has been written to implement the control law described in the sections above. This 
section presents the results of a high-fidelity nonlinear simulation running the flight software. The simu- 
lation dynamics include the three-axis rigid body motion of the spacecraft and momentum states of the 
reaction wheels. Sensors, actuators, and the orbit environment are modelled, including an 8th-order IGRF 
geomagnetic field model. Figures 5-9 show the simulation results of interest. 

While in sunlight, the attitude control requirement is to maintain the spacecraft Z axis 70 deg from the 
Sun vector. During eclipse, the objective is to null rates and null the X and Y components of the momentum 
contained in the reaction wheels, in order to point the Z axis away from the Sun vector. Figure 5 shows 
the Z axis motion with respect to the Sun. In sunlight, the sun sensors provide good attitude information 
which allows attitude maintenance within a few degrees of the target attitude. Upon eclipse entry (at about 
30 minutes), the Z axis moves away from the Sun as desired. Recall that the reference momentum vector 
established in the sunlit portion of the orbit is along the spacecraft -Y axis, which is itself offset from the 
Sun direction by 20 deg. Thus the nominal angle between the +Z axis and the Sun is 160 deg during eclipse. 
The simulated angle exhibits an additional 10-15 deg offset from this command, due to a residual rate about 
the +Z axis. This residual rate is in turn due to drift of the local geomagnetic field, an expected source of 
error. The pointing performance observed is quite acceptable for a Safe Mode, the objective being simply to 
keep the +Z axis far away from the Sun so that the attitude on eclipse exit is reliably a safe one. 

Another view of the motion is obtained by examination of the components of the spacecraft Y and Z 
axes (denoted Y B and Z B for brevity) with respect to a Sun-pointing inertial reference frame, as is shown 
in figures 6-7. We use the Earth-Centered Inertial frame (+Xjv points to the first point of Aries, +Z N is 
aligned with the Earth’s spin axis), with the simulated date being the spring equinox to place the Sun in the 
+Xat direction. In this reference frame, the +Xjv axis points toward the Sun, so the X-axis trace in figure 
6 is just the cosine of the angle in figure 5. The other traces, and figure 7, give a better view of the attitude 
drift that occurs about the Sun line when the spacecraft is nominally inertially pointed. 

Figure 8 shows the spacecraft angular rates. The largest rate magnitude occurs during the slews that take 
the +Z B axis from its daytime orientation to its anti-Sun eclipse orientation, and its return to the daytime 
attitude upon eclipse exit. Once the anti-Sun attitude is reached, the rates are seen to be bounded and 
modest, justifying the assumptions made in deriving angular rates from magnetic field measurements. As 
mentioned previously, the residual rate about the Z B axis is attributable to the error in this approximation. 
Figure 9 shows the components of the wheel momentum vector, showing that the eclipse control law drives 
the transverse ( X B and Y B ) components toward zero. 
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160 



Figure 5. Angle Between Sun and -j-Z Axis 



Figure 6. Spacecraft Z axis Components in a Sun-pointing Inertial Frame 



Figure 7. Spacecraft Y axis Components in a Sun-Pointing Inertial Frame 
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Figure 8. Angular Rates 



Figure 9. Reaction Wheel Momentum in Spacecraft Body Frame 
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VII. Conclusion 


Attitude stabilization using angular momentum is as old as space flight; many spacecraft have used 
angular momentum for gyroscopic stiffness. The novel feature of the work presented here is the use of a 
momentum vector, not for gyroscopic coupling, but as an inertial reference vector. As has been discussed, 
this unusual application was chosen as a solution to a problem of multiple constraints: a single- string gyro, 
along with thermal and configuration constraints. 

A subsequent question addressed is the stability analysis for a rank-deficient control system. The defi- 
ciency arises from the unobservability of angular rate parallel to the magnetic field. Stability margins were 
confirmed through a robust stability analysis of the linearized system, with the conservative assumption 
of unstructured uncertainties. The effect of magnetic field direction was then found by numerical survey, 
confirming that all roots of the motion are stable for any magnetic field direction, except for the zero root 
corresponding to the unsensed angle about the momentum vector. 

It should be clear that the usefulness of an angular momentum vector as an inertial reference depends 
on maintaining it in the desired direction, and in keeping external perturbations on it to a tolerably low 
level. For VCL, this controller is to be used only during eclipse, when the sun vector is unavailable. So the 
angular momentum vector may be maintained during the sunlit portion of the orbit in the usual fashion, 
using magnetic torquers. Momentum maintenance is disabled through eclipse to avoid perturbing the angular 
momentum while it is being used as a reference. External torques, from gravity-gradient, aerodynamic, and 
other environmental forces, cannot be so easily disabled, so the magnitude of the angular momentum vector 
should be sized to make the angular drift of the momentum vector acceptably small. 

The controller presented here was developed in 1999-2000 for the VCL mission. That program was 
terminated during spacecraft bus integration and testing in 2001 due to payload development issues. The 
bus was then placed in an environmentally controlled container until late 2003, when it was taken from 
storage to be refurbished for an Earth climate monitoring mission, Glory. The plan for NASA’s Glory 
project is to make only those changes to the VCL spacecraft bus that are necessary to meet the Glory science 
requirements. This has meant that the instrument designs have had to adhere to the existing interfaces and 
capabilities as much as possible. Glory has similar attitude constraints as VCL and the gyroless Safe Mode 
originally developed for VCL will fly on Glory when it is launched in June 2009. 
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